Claude
499b753c22
- Un seul conteneur applicatif : Express sert l'API, le frontend React compilé (fallback SPA, cache immutable sur /assets) et les images /uploads (nosniff + CSP default-src 'none') - En-têtes de sécurité (CSP stricte, X-Frame-Options DENY, etc.) portés de nginx vers helmet, compression gzip ajoutée - Application exposée sur le port 8321 (APP_PORT), PostgreSQL sur 127.0.0.1:56432 (DB_PORT, loopback uniquement pour l'admin locale) - TRUST_PROXY pilote la confiance aux en-têtes X-Forwarded-* (désactivé par défaut hors reverse-proxy) - Dockerfile multi-étages unique à la racine (build React → deps → image finale non-root, fs en lecture seule) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fkg15RCxNgUys4ru73He2o
31 lines
976 B
Docker
31 lines
976 B
Docker
# Stage 1 — build the React frontend
|
|
FROM node:22-alpine AS webbuild
|
|
WORKDIR /build
|
|
COPY web/package.json web/package-lock.json* ./
|
|
RUN npm ci 2>/dev/null || npm install
|
|
COPY web/index.html web/vite.config.js ./
|
|
COPY web/public ./public
|
|
COPY web/src ./src
|
|
RUN npm run build
|
|
|
|
# Stage 2 — install API production dependencies
|
|
FROM node:22-alpine AS deps
|
|
WORKDIR /app
|
|
COPY server/package.json server/package-lock.json* ./
|
|
RUN npm ci --omit=dev 2>/dev/null || npm install --omit=dev
|
|
|
|
# Stage 3 — final image: Express serves the API, the frontend and the uploads
|
|
FROM node:22-alpine
|
|
ENV NODE_ENV=production
|
|
WORKDIR /app
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY server/package.json ./
|
|
COPY server/src ./src
|
|
COPY --from=webbuild /build/dist ./public
|
|
# Upload dir owned by the app user; a named volume mounted here inherits
|
|
# this ownership on first use
|
|
RUN mkdir -p /data/uploads && chown node:node /data/uploads
|
|
USER node
|
|
EXPOSE 3000
|
|
CMD ["node", "src/index.js"]
|